infrastructure/machines/fanny/configuration.nix

{ inputs, config, ... }:
let
  sshKeys = import ../ssh_keys.nix;
  peers = import ../modules/malobeo/peers.nix;
  hosts = import ../hosts.nix {};
in
{
  sops.defaultSopsFile = ./secrets.yaml;
  sops.secrets.wg_private = {};
  sops.secrets.shop_auth = {};
  sops.secrets.njala_api_key = {};

  imports =
    [ 
      inputs.malobeo.nixosModules.malobeo.vpn
      inputs.malobeo.nixosModules.malobeo.initssh
      inputs.malobeo.nixosModules.malobeo.disko
      inputs.malobeo.nixosModules.malobeo.microvm
      inputs.malobeo.nixosModules.malobeo.metrics
      inputs.malobeo.nixosModules.malobeo.users
      inputs.malobeo.nixosModules.malobeo.backup

      #./hardware-configuration.nix
      ../modules/sshd.nix
      ../modules/minimal_tools.nix
      ../modules/autoupdate.nix
      ./dyndns.nix
    ];

    virtualisation.vmVariantWithDisko = {
      virtualisation = {
        memorySize =  4096; 
        cores = 3;
      };
    };

  malobeo.metrics = {
    enable = true;
    enablePromtail = true;
    logNginx = true;
    lokiHost = hosts.malobeo.hosts.overwatch.network.address;
  };

  malobeo.autoUpdate = {
    enable = true;
    url = "https://hydra.malobeo.org";
    project = "malobeo";
    jobset = "master";
    cacheurl = "https://cache.malobeo.org";
  };

  malobeo.backup = {
    enable = true;
    snapshots = [ "storage/encrypted" "zroot/encrypted/var" ];
  };

  nix = {
    settings.experimental-features = [ "nix-command" "flakes" ];
    #always update microvms
    extraOptions = ''
      tarball-ttl = 0
    '';
  };

  malobeo.users = {
    malobeo = true;
    admin = true;
    backup = true;
  };

  malobeo.disks = {
    enable = true;
    hostId = "a3c3101f";
    root = {
      disk0 = "disk/by-id/ata-SAMSUNG_MZ7LN256HCHP-000L7_S20HNAAH200381";
    };
    storage = {
      enable = true;
      disks = ["disk/by-id/wwn-0x50014ee265b53b60" "disk/by-id/wwn-0x50014ee2bb0a194a"];
      mirror = true;
    };
  };

  systemd.tmpfiles.rules = [ 
    "L /var/lib/microvms/data - - - - /data/microvms"
    "d /data/microvms 0755 root root" #not needed for real host?
    ];

  malobeo.initssh = {
    enable = true;
    authorizedKeys = sshKeys.admins;
    ethernetDrivers = ["r8169"];
    zfsExtraPools = [ "storage" ];
  };

  boot.initrd = {
    availableKernelModules = [ "wireguard" ];
    # postMountCommands = ''
    #   ip address flush dev wg-initrd
    #   ip link set dev wg-initrd down
    # '';
    systemd = {
      enable = true;
      network = {
        enable = true;
        netdevs."30-wg-initrd" = {
          netdevConfig = {
            Kind = "wireguard";
            Name = "wg-initrd";
          };
          wireguardConfig = { PrivateKeyFile = "/etc/secrets/30-wg-initrd.key"; };
          wireguardPeers = [{
            AllowedIPs = peers.vpn.allowedIPs;
            PublicKey = peers.vpn.publicKey;
            Endpoint = "${peers.vpn.publicIp}:${builtins.toString(peers.vpn.listenPort)}";
            PersistentKeepalive = 25;
          }];
        };
        networks."30-wg-initrd" = {
          name = "wg-initrd";
          addresses = [{ Address = "${peers.fanny-initrd.address}/24"; }];
        };
      };
    };
  };

  boot.initrd.secrets."/etc/secrets/30-wg-initrd.key" = "/etc/wireguard/wg.private";

  services.malobeo.vpn = {
    enable = true;
    name = "fanny";
    privateKeyFile = config.sops.secrets.wg_private.path;
  };

  services.malobeo.microvm = {
    enableHostBridge = true;
    interface = "enp1s0";
    gateway = "192.168.1.1";
    address = "192.168.1.103/24";
  };

  services.malobeo.microvm.deployHosts = [ 
    "overwatch" 
    "infradocs" 
    "nextcloud" 
    "durruti" 
    "zineshop"
    "vaultwarden"
    "pretalx"
    "antamap" 
    "ns1"
    "wordpress"
  ];

  networking = {
    nat = {
      enable = true;
      externalInterface = "enp1s0";
      internalInterfaces = [ "microvm" ];
    };

    firewall = {
      allowedTCPPorts = [ 80 443 ];
    };
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = "malobeo@systemli.org";
    defaults = {
      dnsProvider = "njalla";
      environmentFile = config.sops.secrets.njala_api_key.path;
      dnsPropagationCheck = false;
    };
  };

  services.nginx = {
    enable = true;
    virtualHosts."docs.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.infradocs.network.address}:9000";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };

    virtualHosts."cloud.hq.malobeo.org" = {
      forceSSL = true;
      enableACME = true;
      acmeRoot = null;
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
        extraConfig = ''
          proxy_set_header Host $host;
          client_max_body_size ${inputs.malobeo.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
          client_body_timeout 3600s;
          send_timeout 3600s;
          fastcgi_buffers 64 4K;
        '';
      };
    };

    virtualHosts."cloud.malobeo.org" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.nextcloud.network.address}";
        extraConfig = ''
          proxy_set_header Host $host;
          client_max_body_size ${inputs.malobeo.nixosConfigurations.nextcloud.config.services.nextcloud.maxUploadSize};
          client_body_timeout 3600s;
          send_timeout 3600s;
          fastcgi_buffers 64 4K;
        '';
      };
    };

    virtualHosts."keys.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.vaultwarden.network.address}";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };

    virtualHosts."grafana.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.overwatch.network.address}";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };

    virtualHosts."events.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.pretalx.network.address}";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };

    virtualHosts."tasklist.malobeo.org" = {
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.durruti.network.address}:8080";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };

    virtualHosts."zines.hq.malobeo.org" = {
      forceSSL = true;
      enableACME = true;
      acmeRoot = null;
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.zineshop.network.address}:8080";
        extraConfig = ''
          proxy_set_header Host $host;

          client_body_in_file_only clean;
          client_body_buffer_size 32K;
          
          client_max_body_size 50M;
          
          sendfile on;
          send_timeout 300s;
        '';
      };
    };

    virtualHosts."zines.malobeo.org" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.zineshop.network.address}:8080";
        extraConfig = ''
          proxy_set_header Host $host;

          client_body_in_file_only clean;
          client_body_buffer_size 32K;
          
          client_max_body_size 500M;
          
          sendfile on;
          send_timeout 300s;
        '';
      };
    };

    virtualHosts."antamap.malobeo.org" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.antamap.network.address}:80";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };
    
    virtualHosts."hydra.malobeo.org" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.albert.network.address}:3000";
        recommendedProxySettings = true;
        extraConfig = ''
          proxy_set_header Host $host;
          proxy_set_header X-Forwarded-Port 443;
          proxy_set_header X-Forwarded-Proto https;
        '';
      };
    };

    virtualHosts."rm16bleibt.org" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.wordpress.network.address}";
        extraConfig = ''
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Host $host;
          proxy_set_header X-Forwarded-Port 443;
          proxy_set_header X-Forwarded-Proto https;
        '';
      };
    };

    virtualHosts."cache.malobeo.org" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://${hosts.malobeo.hosts.albert.network.address}:5000";
        extraConfig = ''
          proxy_set_header Host $host;
        '';
      };
    };
  };

  services.tor = {
    enable = true;
    client.enable = true;
  };

  # needed for printing drivers
  nixpkgs.config.allowUnfree = true; 

  services.acpid.enable = true;

  networking.hostName = "fanny";

  virtualisation.vmVariant.virtualisation.graphics = false;

  time.timeZone = "Europe/Berlin";
  system.stateVersion = "23.05"; # Do.. Not.. Change..

  sops.secrets.shop_auth = {
    owner = config.services.nginx.user;
    group = config.services.nginx.group;
  };
}